5 Commits

Author	SHA1	Message	Date
Andrew Thompson	07ed9a88c6	Catch up with the revised network interface cloning which takes an optional ... opaque parameter that can specify configuration parameters.	2006-07-10 05:24:06 +00:00
Andrew Thompson	bac89dcef2	Fix a braino in the last revision, enc_clone_destroy needs return void instead ... of int. The clone system will ensure that our first interface is not destroyed so we dont need the extra checking anyway. Tested by: Scott Ullrich	2006-07-04 23:09:11 +00:00
Andrew Thompson	ae4748ad15	A small race existed where the lock was dropped between when encif was ... tested and then set. [1] Reorganise things to eliminate this, we now ensure that enc0 can not be destroyed which as the benefit of no longer needing to lock in ipsec_filter and ipsec_bpf. The cloner will create one interface during the init so we can guarantee that encif will be valid before any SPD entries are added to ipsec. Spotted by: glebius [1]	2006-06-28 21:57:35 +00:00
Andrew Thompson	f0ac1eedd5	Simplify ipsec_bpf by using bpf_mtap2().	2006-06-27 01:53:12 +00:00
Andrew Thompson	bdea400f3b	Add a pseudo interface for packet filtering IPSec connections before or after ... encryption. There are two functions, a bpf tap which has a basic header with the SPI number which our current tcpdump knows how to display, and handoff to pfil(9) for packet filtering. Obtained from: OpenBSD Based on: kern/94829 No objections: arch, net MFC after: 1 month	2006-06-26 22:30:08 +00:00